KR20030035630A - Method Of Authenticating Subscriber In The Home RADIUS Server Of The Mobile Communication Packet Data Network - Google Patents

Abstract

The present invention relates to a subscriber authentication method in a home radius server of a mobile communication packet data network to transmit the authorization verification information of a subscriber in accordance with a request of each Radius client in a home radius server of a mobile communication packet data network. The present invention provides a method of determining whether a subscriber is a roaming subscriber of another network by receiving an access request message from a Radius client at a local Radius server when a subscriber of a mobile terminal attempts to provide packet data service; Searching for the home radius server of the subscriber in the local radius server, generating a proxy-state attribute, and including the same in the access request message to the home radius server; Receiving the access request message at the home radius server and identifying a manufacturer of the radius client; Transmitting, by the home radius server, the identified manufacturer-specific attribute to the local radius server by including it in an access approval message; And receiving the access approval message from the local Radius server and transmitting the access authorization message to the Radius client to which the subscriber is connected to provide a service according to the authority information of the subscriber.

Description

Method of Authenticating Subscriber In The Home RADIUS Server Of The Mobile Communication Packet Data Network}

The present invention relates to a subscriber authentication method in a home radius server of a mobile communication packet data network. In particular, the home radius server of a mobile communication packet data network transmits authorization verification information of a subscriber in accordance with a request of each radius client. A subscriber authentication method in a home radius server of a mobile communication packet data network.

In general, the Radius server is a server that performs authentication, authorization, and accounting functions for subscribers in a mobile communication packet data network, and provides PDSN and subscriber packets for providing network access services to subscribers. Performs interworking with HA and other Radius servers that provide routing services.

As shown in FIG. 1, the general mobile communication packet data network structure includes a mobile terminal 10, an RN 20 for managing radio resources, a PDSN 30 for providing a network access service to a subscriber, and a mobile terminal. (Mobile) HA for providing an IP service, a local Radius server 50 directly connected to the corresponding PDSN (30), and to manage the authentication, authorization information and billing data of the mobile subscriber through the Internet network It comprises a home Radius server 60 and IP network 70.

The subscriber authentication method in the mobile communication packet data network configured as described above will now be described with reference to FIG.

First, in order to attempt packet service, the mobile terminal 10 establishes a session with the PDSN 30 through the RN 20.

At this time, the PDSN 30 detects the session setup of the mobile terminal 10 through the RN 20 and generates an access request message for authentication and authorization of the subscriber. It transmits to the local Radius server 50 of the network.

Accordingly, the local radius server 50 checks whether there is an access request message received from the PDSN 30, and receives the corresponding access request message, indicating that the subscriber of the mobile terminal 10 is a local subscriber or another. Determine whether the network is a roaming subscriber.

At this time, if the subscriber of the mobile terminal 10 is a local subscriber, the local Radius server 50 performs the authentication itself, and generates an access approval message to generate the access information to the corresponding access approval message (Access Accept Message) To the PDSN (30).

On the other hand, if the subscriber of the mobile terminal 10 is a roaming subscriber of another network, the local Radius server 50 transmits an access request message received from the PDSN 30 to the home Radius server 60 of the subscriber. do.

Accordingly, the home radius server 60 receives the access request message through the local radius server 50, authenticates the subscriber of the mobile terminal 10, and generates an access approval message. The authority information is loaded on the access approval message and transmitted to the local Radius server 50.

Then, the local radius server 50 receives the access grant message from the home radius server 60 and transmits the received access grant message to the PDSN 30 to which the subscriber is connected.

Accordingly, the PDSN 30 receives the access approval message through the local Radius server 50 and provides a service to the mobile terminal 10 according to the authority information of the subscriber.

Thereafter, an additional access request message may be transmitted from the HA 40 to the local Radius server 50 according to the type of service provided to the subscriber, and the procedure for transmitting the message may include the access request transmitted from the PDSN 30 described above. It is the same procedure that a message is processed.

However, PDSN and HA of various manufacturers exist in a general mobile communication packet data network, and in this case, authorization information transmitted to PDSN and HA requiring a value other than the attributes defined in the standard may have manufacturer-specific attributes. Must be included in order for the subscriber to receive the correct services.

However, the home Radius server of the subscriber receiving roaming service in a network other than the local subscriber cannot know the PDSN information because it is not directly connected to the PDSN. In addition, since the home radius server and the HA may not be directly connected in the network configuration, the home radius server may not know the HA information.

As such, since the Radius client such as PDSN and HA to which the home Radius server is interworking cannot be correctly identified, the exact authority information for the subscriber cannot be transmitted to the Radius client, and thus the service can be provided to the subscriber. There was a problem that no situation occurs.

The present invention has been made to solve the above-mentioned problems. In the mobile communication packet data network, when the home Radius server is interworking with a different type of Radius client, the subscriber's authority verification information is adapted to meet the needs of each Radius client. To convert and send.

In addition, the present invention transmits information about the Radius client using a proxy-state attribute when interworking between the Radius server and the Radius client in the mobile communication packet data network, and the home Radius server transmits the information about the Radius client. By identifying the Radius client, it is easy to configure the network of the mobile communication packet data service provider to increase the scalability of the network. When the Home Radius server interworks with other new Radius clients, there is no need for additional operation maintenance work. There is no purpose.

1 is a block diagram showing the structure of a typical mobile communication packet data network.

2 is a flowchart illustrating a subscriber authentication method in a mobile communication packet data network.

3 is a flowchart illustrating a subscriber authentication method in a home radio server of a mobile communication packet data network according to an embodiment of the present invention.

4 shows the structure of a proxy-state attribute in FIG.

* Description of the symbols for the main parts of the drawings *

10: mobile terminal 70: IP network

20: RN (Radio Network)

30: Packet Data Serving Node (PDSN)

40: HA (Home Agent)

50: Local RADIUS Server

60: Home RADIUS Server

The subscriber authentication method in the home Radius server of the mobile communication packet data network of the present invention for achieving the above object is accessed from the Radius client in the local Radius server when the subscriber of the mobile terminal attempts packet data service. Receiving a request message and determining whether the corresponding subscriber is a roaming subscriber of another network; Searching for the home radius server of the subscriber in the local radius server, generating a proxy-state attribute, and including the same in the access request message to the home radius server; Receiving the access request message at the home radius server and identifying a manufacturer of the radius client; Transmitting, by the home radius server, the identified manufacturer-specific attribute to the local radius server by including it in an access approval message; And receiving the access approval message from the local Radius server and transmitting the access authorization message to the Radius client to which the subscriber is connected to provide a service according to the authority information of the subscriber.

Preferably, in another aspect of the present invention, the proxy-state attribute may include a type field indicating a proxy-state, a length field indicating a length of an entire message including the type field, and a manufacturer-specific value of the Radius client. And an additional string field including an additional string field for identifying the Radius client, and an additional information field including information for use in the local Radius server itself. do.

Also preferably, in another aspect of the present invention, the identifying the manufacturer of the Radius client may include identifying the Radius client at the home Radius server by the manufacturer identifier field or the additional string field of the proxy-state attribute. It features.

Best Mode for Carrying Out the Invention Embodiments of the present invention will be described below with reference to the drawings.

Since the configuration for the subscriber authentication method in the home Radius server of the mobile communication packet data network according to the embodiment of the present invention is the same as the conventional technology, description thereof is omitted.

The subscriber authentication method in the home Radius server of the mobile communication packet data network according to an embodiment of the present invention will be described with reference to the flowchart of FIG. 3.

First, the mobile terminal establishes a session with the PDSN or the HA through the RN in order to attempt packet service.

At this time, the PDSN or HA detects the session setup of the mobile terminal through the RN, generates an access request message for authentication and authorization of the subscriber, and transmits the generated access request message to the local Radius server of the network to which it belongs.

Accordingly, the local Radius server checks whether there is an access request message received from the PDSN or HA (step S1), and when receiving the access request message, the subscriber of the mobile terminal is a local subscriber or roaming of another network. It is determined whether the subscriber (step S2).

In this case, if the subscriber of the mobile terminal is a local subscriber, the local Radius server performs an authentication by itself as in the conventional technology, and then generates an access approval message and places the authority information in the corresponding access approval message to display the PDSN or the like. Transfer to HA (step S3).

On the other hand, if the subscriber of the mobile terminal is a roaming subscriber of another network, the local Radius server performs an internal procedure to search for the subscriber's home Radius server for relaying messages (step S4).

The local radius server then configures the proxy-state attribute in the form as shown in FIG. 4 to inform the retrieved home radius server the manufacturer of the PDSN or HA (step S5).

In this case, the proxy-state attribute is for transmitting information on PDSN and HA, and includes a type field, a length field, a manufacturer identifier field, an additional string field, and an additional information field.

Here, the type field has a value of '33', which indicates a proxy-state. The length field is a field indicating the length of the entire message including the type field. The Manufacturer Identifier field contains manufacturer-specific identifiers defined in the 'RFC1700 (Assigned Numbers)' document as manufacturer-specific values of the corresponding PDSN and HA. The additional string field includes additional string information for identifying the PDSN and the HA. This additional information field contains information for the local Radius server to use itself.

The local radius server then includes the configured proxy-state attribute in the access request message received from the PDSN or the HA and transmits it to the home radius server (step S6).

Accordingly, the home radius server receives an access request message including a proxy-state attribute transmitted from the local radius server (step S7).

In this case, the access request message including the proxy-state attribute may go through a broker RADIUS server in the middle of a transmission path while the access request message including the proxy-state attribute is relayed to the home radius server. Since the server does not perform any processing on the proxy-state attribute, the home radius server may receive an access request message including the proxy-state attribute sent by the local radius server.

Accordingly, the home radius server may include the manufacturer identifier field or an additional string field of the proxy-state attribute added by the local radius server among the proxy-state attributes included in the access request message received from the local radius server. The manufacturer of the PDSN or HA is identified (step S8).

In this case, the access request message including the proxy-state attribute may include a plurality of proxy-state attributes by the broker radius server in the middle of the transmission path, but the proxy-state attribute included by the local radius server is always included. Since it is located at the beginning, the home Radius server can always identify the information of the proxy-state attribute sent by the local Radius server.

Then, the home radius server includes a manufacturer-specific attribute corresponding to the manufacturer of the identified PDSN or HA in the access authorization message and transmits it to the local radius server (step S9).

Then, the local Radius server checks whether there is an access acknowledgment message including a manufacturer-specific attribute transmitted from the home radius server (step S10), and transmits the corresponding access acknowledgment message to the PDSN or the HA (step S11). ).

Accordingly, the PDSN or the HA may receive the access approval message through the local Radius server and provide a service to the mobile terminal according to the subscriber's authority information (step S12).

As mentioned above, although the invention made by this inventor was demonstrated according to the said Example, this invention is not limited only to the said Example, Of course, a various change is possible in the range which does not deviate from the summary.

As described above, according to the present invention, when the home Radius server and various Radius clients are interworked in the mobile communication packet data network, the local Radius server transmits information on the corresponding Radius client using the proxy-state attribute. By allowing the home Radius server to identify the corresponding Radius client, the subscriber can receive the correct service and make the network configuration of the mobile communication packet data service provider easier to increase the network scalability. It also eliminates the need for additional production maintenance on the Home Radius server when it interacts with other new Radius clients.

Claims (3)

Determining whether the corresponding subscriber is a roaming subscriber of another network by receiving an access request message from the Radius client at the local Radius server when the subscriber of the mobile terminal attempts packet data service; Searching for the home radius server of the subscriber in the local radius server, generating a proxy-state attribute, and including the same in the access request message to the home radius server; Receiving the access request message at the home radius server and identifying a manufacturer of the radius client; Transmitting, by the home radius server, the identified manufacturer-specific attribute to the local radius server by including it in an access approval message; And receiving the access authorization message from the local Radius server and transmitting the received access authorization message to the Radius client to which the subscriber is connected to provide a service according to the subscriber's authority information. How to authenticate subscribers on your home Radius server. The method of claim 1, The proxy-state attribute may include a type field indicating a proxy-state, a length field indicating a length of an entire message including the type field, a manufacturer identifier field indicating a manufacturer-specific value of the Radius client, and the Radius client. An additional string field including additional string information for identifying an additional string field and an additional information field including information for use in the local radio server itself. Subscriber authentication method in. The method of claim 1, The identifying of the manufacturer of the Radius client may include identifying the Radius client in the home Radius server using the manufacturer identifier field or the additional string field of the proxy-state attribute. Subscriber authentication method in.